Best Practices for Energy Price Indices © Copyright 2003, CCRO. All rights reserved. 14 4.1.15 Changes in Methodology or Index Specifications If an index developer has reasons for changing the methodology or other specifications of an index (e.g., the specific hubs included in an index), the developer should inform data providers and index users before implementing the change and identify the implementation date for the new methodology. Reasonable prior notice should be given so that data providers can make the necessary technology and reporting adjustments to accommodate the change and possibly adjust contractual agreements with third parties correspondingly. This notice period will also enable index users to evaluate and provide comments on the proposed new methodology. 4.2 Index Developer Best Practice Organization and Controls Given the voluntary nature of participation by data providers in the index construction process and the highly sensitive nature of the data provided, index developers should create an environment in which data providers are assured that “the strictest of standards of care” will be maintained by the index developer over commercially sensitive data (which may include counterparty name and buy/sell indicator). This leads to the following recommendations: 4.2.1 Determine and Publish Indices Through a Department Independent from Journalistic Activities Any employees and departments within an index developer granted access to information from a data provider should not have any economic interest in the information being provided to them beyond the pure commercialization of the finished index itself. In particular, if an index developing company is also involved in reporting about the markets for which the indices are published, the journalistic activities of the index developer should be distinct and separate from the index construction activities, and no commercially sensitive information should be allowed to flow from the index developing department to the journalistic departments of an index developing company. Personnel involved in each activity should ensure that confidential and sensitive information, in particular transacting party names and specific transaction details, is kept confidential and should sign explicit confidentiality agreements To insure adequate protection, best practice for the submission of certain transaction characteristics (buy-sell and counterparty information) may require submission of such information only to an independent third party responsible for maintaining the confidentiality of information submitted. 4.2.2 Demonstrate Sufficient Protection Against Data Release or Misuse at All Levels Index developers should demonstrate sufficient protection against data release or misuse at all levels, in particular at the technical (IT and data security), organizational, and procedural level. The level of data protection should be a function of the commercial sensitivity of the data submitted the highest level of protection should apply and should be demonstrated if counterparty name and buy/sell indicator are submitted. 4.2.3 Conduct Independent Audits Independent (internal or external) audits should be conducted by each index developer at its expense at least annually to determine the following: